When is a file actually deleted?

First, I'd like to say 'thanks' to Jethro and sOnic and the others who were giving me a lot of good answers in the live chat on this topic.
I thought this might be interesting as it is all over the news relating to security, terrorism, and hacking/cracking.
That kid a few days ago from Austria (I believe), who hacked into the Pentagon. If I were him, and I wanted to clean the evidence from my hard drive, what would I do? Because the 'delete' button (at least as far as I understand in Windows) doesn't really delete a file, it just deletes the pointer, correct? What about other systems, i.e. RedHat, BSD, etc.?
I think a tutorial may be in order here. Anyone want to volunteer?
So to summarize...

When is a file actually deleted from your hard drive?

In about half an hour, expect a lovely program that will deal with this, for you. I'm just working out the finer points of it on IRC at the moment....

your correct when you say that a file isn't deleted it just removes the pointer - this means that windows then sees that space as free again and writes over the top of it....this is when most people consider a file to be completely erased as it has been written over.
But I think I remember reading an article claiming that the NSA could recover files from HD's that had been written over up to 24 times!
So I would say a file is truely deleted when you

• Smash your HD with a sledgehammer
• turn the bits into dust with a chainsaw
• burn the dust
• throw the ash out to sea

maybe just maybe if you do all of that they won't be able to recover the files ;)
hehe

v_Ln

Maybe something like this might work

Code:

---

/* File Massacre
  Email Jethro @
  [email protected] */

#include <fstream.h>
#include <io.h>

#define PROG_NAME "File Massacre by Jethro"

void main()

{

cout  << PROG_NAME << endl;

int i;

for (i=1; i<=1000; i++) {

      ofstream File;

      File.open("killme.txt");

      File.close();

      _unlink("killme.txt");

      }

}

---

Sorry jethro, but I don't follow... what is that code supposed to do?

dmedici you can find programs that will write data over the file so they can't be recovered with any undelete programs. That should be good enough but if you’re truly paranoid you can write over the data as 30 times just to be sure. But now you might be thinking what if the FBI comes, breaks through the door and tries to steal my hotmail password, I wouldn’t have time to write over the data 30 times. Well in that case you use a removable hard drive and when the FBI comes you can just take it out and dump it in a vat of battery acid that you keep beside your desk.

Yup its true, the file isn't deleted, it just get erased from your mind. Files are enver actually deleted, just written over, so the you won't have much luck with the delete keys. But there are a few solutions, for one thing, you can get a hard drive killer, get an extra comp, hack, do whatever, and run a hard drive killer, they are probably pretty effective. Option number 2 is getting one of those proggies that make sure the data you delete is unrecoverable.

Quote:

---

Maybe something like this might work

---

Overwriting the same file name over and over is not the same thing as writing over the sector of the hard drive that contains the file.

Sorry about my spelling mistakes, I use quick reply, and don't check over any errors.
it just get erased = it just getg erased
Files are enver = Files are never

Oops, another one
getg = gets
sorry about these annoying posts, but they do after all keep the thread on top.

i know that in KDE3.0 you can do move to trash (del) delete (shift+del) or shread (crtl+shift+del) the last one overwrites the file i think 30 times........... not really 100% sure if its random character replacement or if it just dose character adition like is easy to do and easy to recover........ so in conclusion, use KDE, and re compile the code so that when you hit del it dose the shread command and when you do ctrl+shift+del it dose the move to trash command

Rofl cwk9, your post was hilarious! Maybe I'll write a newbie hacker guide, and tell them to get a vat of battery acid and put it beside their computer.

There are many programs out there that can truly delete the file. Like, for linux, the program wipe, will wipe over the sector of the drive the file was, with another, as many times as you would like. It does not take very long either. :)

You can use PGP/GPG to 'wipe' your files off of the disk. Which in my understanding overwrites that data, how ever many times you choose to do so. Also, what about encrypting the files first, then 'wiping' them? So that if it were to be recovered, they would still have to unencrypt the file.

Actually, a portable h/d would be pretty sweet and a good idea, maybe expensive, but sweet.

i dont think the NSA can retrieve a file that has been over written 24 times, just delete the file in good old dos. and the file is GONE.

illv //

illv--> no, DOS only deletes the reference in the FAT. the data is still there and can easly be re constructed just by pointing to it again without overwriting the data. if its "deleted" then its like a peice of paper thats sitting in your trashcan (real trashcan, not puter one)..... anyone wanting to and knowing how can go rummaging thru it. once it gets overwritten then its like the garbage truck taking away your trash. the more times it gets overwritten the more layers of trash get piled on top of it at the dump. they can still read it when its in your trashcan, and they can read it after 4-5 overwrites (if there lucky) the NSA claims 24 overwrites cause thats what there best recovery has been, and that was probly testing with a known data to recover. the NSA will be infanatly lucky to read something thats been over written 10 times, and then thats only of they REALLY wanna pour all that money and experteese into reading your emails. hell, id say that if they got binladens hdd theyd be hard pressed to put that much money into it.

also, you might wanna look up some data recovery companys online, send them a hdd, they send you everything that they can recover from it, and its ALOT! another thing, in windows every little time that it works with a file it gets cached, in your nice little swap file most likely so thats TWO places that every file gets saved

there ARE portable hdds, about the size of cd players. I saw one that used firewire and one that used both firewire/usb 2.0..........i'm searching for a link, if i find one, i'll edit and post it

{sorry if this has already been said, i just kinda browsed through, and noticed a 'that would be sweet if......'}

Your best bet, like me is to keep a few removable hdd laying around. the like cwk9 said just dump it in the battery acid. but it is a good suggestion. i found a program called kill disk. just ask me and ill send it too ya. it takes about 30 seconds to "kill disk"

If i were that dude, you know what I would do?


let me explain:


first, I would properly remove my hard drive(s) from my computer, and place it at the peak of my two-story house. then I'd kick it off as hard as I can and watch it fly into the middle of the street and get ran over a few times. then I'd take it to my back yard and steal my neighbors speed boat. I'd then fill the boat with gasoline and a really long-ass wick to blow it up. then I'd make surethat the ashes were completely scattered throughout my town. then I might at least feel sae about it. I might even decide to move asap :)

Just a newbie suggestion here....but why not go to techtv.com, search for a program that fully deletes files off your hard drive, then hop on over to download.com and find a file recovery program. Then..once you got them all going on the same system, create a notepad document, then delete it and see if you can pull it back up. Never have done this before, but dont chance an agent bashing into your door and just opening up your case to rip out the hd. They have some very, very wicked file recovery programs out there.

hence the big explosion destroying the hard drive. its the only fool profe way. the only problem is explaining why you did it....


personally I like mcafee's undelete utility for undeleteing files. its alright.

and as far as being a newbie: just cuz I'm a newbie doesnt mean im ignorant, and you had better believe im not ;)

hence the big explosion destroying the hard drive. its the only fool profe way. the only problem is explaining why you did it....


personally I like mcafee's undelete utility for undeleteing files. its alright.

and as far as being a newbie: just cuz I'm a newbie doesnt mean im ignorant, and you had better believe im not

hai jethro
how this will work? pls write briefly

- Informational QuickErase -

In the "old days" they used to have big electromagnets and external hdd's. Incase of a unwanted visitor, they just pulled the switch.

It worked then and should probably work fine with todays hdd's aswell.

You'll not be able to use the hdd anymore and that's the sad part when dealing with electromagnet-erasing.

Had a client bring in his HDD a few days ago.. problem his computer didn't boot. So on the advice of an "expert" he run scan disk.... now all he had was a hdd full of DIR0xxx folders .. yep damaged FAT.. and he let M$hit Scandisk f*** it for him. He finaly decided to bring it to me to see what I could do.. He had his business data for the last 3 years on it and had been backing up the wrong files.. his sorrow only compounded a mistake a few days earlier where he had accidently deleted an important file..

A FREEWARE proggie was thrown into action.. a couple of hours later, and with the realisation that 20% of the data on a normal FAT recovery was corrupt, and not going any deeper we had ALL of the data he was after.. all the corruption was in M$ windaz.. not his data.. now if that had failed, I had two other proggies that I could have played with..
but the pile of "red backs" would have been higher..

so if it is deleted or "written over" it isn't Gone.. 6 months ago I would have believed different.. but thanks to links from the crew here oh and Google I now KNOW different..

At the moment I believe that all data is lost when the HDD is reduced to the molecular level, certainly lost when hdd is reduced to the atomic level, and definatly lost when the HDD is reduced to the Sub-Atomic level.. But I have been proven wrong..

Cheers

I have used evidence eliminator in the past, it seemed as if it was working, but honestly, I don't know enough about the technology behind it to know if it really worked or not. It was pulling up stuff that I hadn't seen in ages.

What program is recommended for eliminating all of the deleted material? Has anyone ever tried EE? If so, should I be using this program or is there something better?

Just my two cents to the topic at hand. I haven't ever used Evidence Eliminator, so I can't speak about it. I have tested a program called Eraser that seems to do the job for you. You can find the download for it HERE along with a few others.

Hope this helps someone!

Quote:

---

Originally posted here by dmedici

That kid a few days ago from Austria (I believe), who hacked into the Pentagon. If I were him, and I wanted to clean the evidence from my hard drive, what would I do?

---

Not related to deleting files at all.. But that story was totally faked. The kid did no cracking of any kind and just faked the documents. You will have to translate the original from German. I'm just going to link to the Security Network news blurb about it as they have a lot of links with good information about this.

http://www.atstake.com/security_news/

It is about the fourth blurb down.

Quote:

---

Originally posted here by LoggOff
illv--> no, DOS only deletes the reference in the FAT. the data is still there and can easly be re constructed just by pointing to it again without overwriting the data. if its "deleted" then its like a peice of paper thats sitting in your trashcan (real trashcan, not puter one).....

---

Actually DOS doesn't even do that. They just replace the first character, or was it that last, with a '?'. The filesystem then knows that that sector can be used again, all an undelete does is remove the '?', which is why in older dos versions doing an undelete would cause the last character to be removed if you had already hit the file name size limit. You can actually do a delete by renaming a file xxx.xxx to ?xxx.xxx.

This worked in dos 6.1. Not sure about the versions that came with 98, etc..

hmmmm i veaguly remember seeing those ?files once or twice..... i dont remember how or anything cause it was before my geek days......